Welcome to WebmasterWorld Guest from

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Block non-North American Traffic for Dummies Like Me

Reducing the size of your blocking list.

6:48 pm on Apr 17, 2014 (gmt 0)

Senior Member

WebmasterWorld Senior Member Top Contributors Of The Month

joined:Aug 1, 2013
votes: 8

First off, this subject has been discussed before but I felt that there's enough current interest in this board and on other boards here at WebmasterWorld alone, to warrant a fresh top-down discussion of the subject. We'll see if our moderators agree.

The list of CIDRs below was compiled from the Iana IPv4 Address Space Registry report [iana.org]. The list is a compact version of all Allocated non-ARIN /8 blocks (from APNIC, RIPE NCC, AFRINIC, and LACNIC). For example, actually merges and into a single CIDR. The largest block in this list is which merges the through address range.

Some of the CIDR's below merge blocks from different registries e.g. combining blocks from both RIPE NCC and APNIC. As such, this does not in any way represent an approach surgical enough to differentiate blocks in one RIR from blocks in another (let alone blocks representing specific countries). The goal here is to arrive at a blocking strategy that keeps people and bots from outside North America off your site.

It should also be noted that the list below is only intended as a good first step where blocking is concerned. There are many holes in the Legacy blocks that this step does not address and proxies are another whole topic of ingress. The intention here is to succinctly narrow the scope of the task with as little effort as possible.

One tangible benefit of this approach can be seen in the range which blocks to This CIDR contains some AWS and Rackspace ranges (and probably other server farms as well). Blocking this range means you don't have to identify and separately block those server farm ranges.

So, I'm hoping that

1.This list is helpful to those looking for a starting point
2.That, if there's a mistake in the list above, that the moderators will see fit to correct the list when the mistake is identified so that the first post can reflect accurate and up-to-date information.
3.That this discussion can move forward with new ranges outside the Allocated blocks to help expand this list even further. Anyone want to block the UK Ministry of Defence (sic)? That /8 block and others are omitted here in this initial list because they are Legacy blocks.

And last for now. It is possible to further reduce the above list to a series of Regular Expressions which would be even more condensed than the list above. For those with access to a rewrite module (Apache or IIS) this list would be valuable but I'll leave up to an expert in that arena to post the list if they care to. I hope this helps someone and can save them the time I (and many others) have spent whittling down the world a bit.

Comments and corrections are most welcome!
6:16 am on Apr 26, 2014 (gmt 0)

Senior Member from LK 

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month

joined:Nov 16, 2005
votes: 17

Two questions for ecommerce sites who do not deliver abroad:

1) Does you order process allow people to enter a foreign credit card billing address? There is at least one British site I would have bought a few hundreds of pounds worth of stuff from if they did.

2) If the answer to 1) is yes, do you know how many people on with foreign billing addresses bought from you? If you use a payment processor do you even have the data?

3) If the answer to 1) is no. Why not?

Also, does anyone have any numbers on the rate of false positives.

As far as language is important, this makes interesting reading:

[en.wikipedia.org ]

Although I can see some of the numbers are badly off the overall picture is correct.
2:32 pm on June 26, 2014 (gmt 0)

New User

joined:June 26, 2014
posts: 4
votes: 0

webcentric, thank you very much for this list. It has been extremely helpful to me in reducing the amount of time I have had to spend battling spammers and scrapers.

I found another range that I think should probably be included:

[edited by: incrediBILL at 6:21 pm (utc) on Jun 26, 2014]
[edit reason] thread cleanup, see TOS #4 [/edit]

6:25 pm on June 26, 2014 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
votes: 2

FWIW, the 144 Class A includes some Aussie-Kiwi ranges.
^144\.(13[013-9]|160)\. [OR]
6:38 pm on June 26, 2014 (gmt 0)

New User

joined:June 26, 2014
posts: 4
votes: 0

Per the OP, these rules are for blocking non-North American traffic.
This 94 message thread spans 4 pages: 94